xloader | d1933850d05d345bc57356333ebe41446a5e1f7a7b09626a6906202f174852c1

Analysis

max time kernel
62s
max time network
56s
platform
windows7_x64
resource
win7v20210408
submitted
30-07-2021 15:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6707289e11e16158e605882cdd2ce2fc9574428dd0114c6d6246146cb6ba7b1b.exe
Size

629KB
MD5

401dd1e7907e4e7f7cc2c5bbb958df9d
SHA1

39b943e797c7a932f4a65a7d8f90bea31e0d7c05
SHA256

6707289e11e16158e605882cdd2ce2fc9574428dd0114c6d6246146cb6ba7b1b
SHA512

27c9aa747bf843cb49a253253f8055cf2d856258294582e5ba1c7b6548b003ee56b37f5eabaaae9578c98784dce8011271e01be97d2dab752855b3244be7e069

Score

10^/10

xloader loader rat

Malware Config

Extracted

Family

xloader

Version

2.3

http://www.lazz.life/mm8v/

Decoy

candobiotec.com

furnikna.com

smartmoto-canada.com

austinsubarusouth.com

seauxfierce.com

ashcomgh.com

salvamentoselcastor.com

lifetioncoin.tech

mypay.money

eczaci-tr.com

fireloxmusic.com

prendafamily.com

chroniclefighter.com

ogopizza.online

qualiacare.com

kamenjoy.com

shinanogroup.com

zaceniadult.info

thehetaira.com

enter-coworking.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

resource	yara_rule
behavioral26/memory/920-66-0x000000000041D000-mapping.dmp	xloader
behavioral26/memory/920-65-0x0000000000400000-0x0000000000428000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1220 set thread context of 920	1220	6707289e11e16158e605882cdd2ce2fc9574428dd0114c6d6246146cb6ba7b1b.exe	29

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
920	6707289e11e16158e605882cdd2ce2fc9574428dd0114c6d6246146cb6ba7b1b.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1220 wrote to memory of 920	1220	6707289e11e16158e605882cdd2ce2fc9574428dd0114c6d6246146cb6ba7b1b.exe	29
PID 1220 wrote to memory of 920	1220	6707289e11e16158e605882cdd2ce2fc9574428dd0114c6d6246146cb6ba7b1b.exe	29
PID 1220 wrote to memory of 920	1220	6707289e11e16158e605882cdd2ce2fc9574428dd0114c6d6246146cb6ba7b1b.exe	29
PID 1220 wrote to memory of 920	1220	6707289e11e16158e605882cdd2ce2fc9574428dd0114c6d6246146cb6ba7b1b.exe	29
PID 1220 wrote to memory of 920	1220	6707289e11e16158e605882cdd2ce2fc9574428dd0114c6d6246146cb6ba7b1b.exe	29
PID 1220 wrote to memory of 920	1220	6707289e11e16158e605882cdd2ce2fc9574428dd0114c6d6246146cb6ba7b1b.exe	29
PID 1220 wrote to memory of 920	1220	6707289e11e16158e605882cdd2ce2fc9574428dd0114c6d6246146cb6ba7b1b.exe	29

C:\Users\Admin\AppData\Local\Temp\6707289e11e16158e605882cdd2ce2fc9574428dd0114c6d6246146cb6ba7b1b.exe
"C:\Users\Admin\AppData\Local\Temp\6707289e11e16158e605882cdd2ce2fc9574428dd0114c6d6246146cb6ba7b1b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1220
- C:\Users\Admin\AppData\Local\Temp\6707289e11e16158e605882cdd2ce2fc9574428dd0114c6d6246146cb6ba7b1b.exe
  "C:\Users\Admin\AppData\Local\Temp\6707289e11e16158e605882cdd2ce2fc9574428dd0114c6d6246146cb6ba7b1b.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:920

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/920-65-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/920-67-0x0000000000870000-0x0000000000B73000-memory.dmp

Filesize
3.0MB

Download
memory/1220-59-0x0000000000C50000-0x0000000000C51000-memory.dmp

Filesize
4KB

Download
memory/1220-61-0x0000000004960000-0x0000000004961000-memory.dmp

Filesize
4KB

Download
memory/1220-62-0x0000000000510000-0x000000000052B000-memory.dmp

Filesize
108KB

Download
memory/1220-63-0x0000000005260000-0x00000000052CF000-memory.dmp

Filesize
444KB

Download
memory/1220-64-0x00000000009B0000-0x00000000009DB000-memory.dmp

Filesize
172KB

Download